EasyIO Neo EC CVE-2026-71450

Exploitation targets EasyIO Neo EC firmware 3.3b62 through 3.3b63 and CW Edge Controller firmware 3.3b24 through 3.3b25 specifically; other versions are outside the stated affected range. The flaw is an authentication bypass via an alternate path or channel (CWE-288), but the precise feature, protocol, or configuration constituting that alternate channel is not described in the available sources. Limiting factors per the vendor CVSS 4.0 vector: high attack complexity (AC:H), a required attack precondition (AT:P), high privileges (PR:H), and active user interaction (UI:A) - these substantially narrow realistic exploitation and conflict with the 'authentication bypass' label, so defenders should confirm the true precondition and privilege requirement with Johnson Controls.

Signals are moderate and partly conflicting. The vendor-supplied CVSS 4.0 score is 8.7 (high) with full confidentiality/integrity/availability impact on both the vulnerable and subsequent systems, and the vuln.today decision label is 'this_week', indicating a prompt-but-not-emergency priority. However, the same CVSS 4.0 vector materially constrains real-world exploitability: AC:H (high attack complexity), AT:P (a specific attack requirement must be met), PR:H (high privileges) and UI:A (active user interaction) together mean this is far from a trivial drive-by despite AV:N. There is a notable internal conflict: the vulnerability is described as an authentication bypass (CWE-288) via an alternate path or channel, yet the vendor vector rates PR:H and UI:A - an auth bypass that still requires high privileges and active interaction is unusual and should be verified with Johnson Controls. No EPSS score was provided, so statistical exploitation probability cannot be weighed; there is no CISA KEV listing and no public exploit identified at time of analysis. Net: a genuinely high-impact flaw in OT/building-automation gear that warrants timely patching, but the heavy preconditions in the vendor vector and the absence of exploitation evidence argue against treating it as an active emergency.

An attacker with network reachability to an EasyIO Neo EC or CW Edge Controller abuses an alternate path or channel to bypass authentication and obtain control over the building-automation controller, affecting HVAC/building functions it manages. The exact alternate channel is not described in available sources, and the vendor vector indicates the attack also depends on a specific condition (AT:P), elevated privileges (PR:H) and active user interaction (UI:A). No public exploit code has been identified.